Security audit

Linear

Security checks for vulnerabilities and agentic risk

Overview

The skill is a legitimate Linear helper, but it needs review because it can change Linear data and its script handles user input, credentials, and local cache files unsafely.

Install only if you are comfortable giving this helper a Linear API key that can read and change your workspace. Prefer a least-privilege token, avoid using it with untrusted issue titles, comments, project names, or usernames, and consider fixing the script to use GraphQL variables, safe JSON encoding, a private cache directory, and explicit confirmation for write actions before relying on it in an agent workflow.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/linear.sh:13
Finding: GraphQL and JSON Injection Through Untrusted Command Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/linear.sh:13-18, 75-80, 126-133, 140-151, 161-176, 182-190, 207-218, 246-263` **Vulnerability Type**: GraphQL injection and unsafe JSON construction **Risk Level**: High ### Vulnerable Code ```bash gql() { local query="$1" curl -s -X POST "$API" \ -H "Content-Type: application/json" \ -H "Authorization: $LINEAR_API_KEY" \ -d "{\"query\": \"$query\"}" } ``` Representative vulnerable call sites include: ```bash gql "{ workflowStates(filter: { team: { id: { eq: \\\"$team_id\\\" } }, name: { eq: \\\"$state_name\\\" } }) { nodes { id } } }" ``` ```bash project_name="${1:-}" if [[ -z "$project_name" ]]; then echo "Usage: linear.sh project <name>" >&2 exit 1 fi gql "{ projects(filter: { name: { containsIgnoreCase: \\\"$project_name\\\" } }, first: 1) { nodes { issues(first: 30, filter: { state: { type: { nin: [\\\"completed\\\", \\\"canceled\\\"] } } }) { nodes { identifier title state { name } priority priorityLabel assignee { name } } } } } }" | format_issues ``` ```bash team_key="${issue_id%%-*}" issue_num="${issue_id##*-}" gql "{ issues(filter: { number: { eq: $issue_num }, team: { key: { eq: \\\"$team_key\\\" } } }) { nodes { identifier title description state { name } priority priorityLabel assignee { name } project { name } team { name } createdAt dueDate } } }" ``` ```bash # Escape quotes in title and description title="${title//\"/\\\"}" description="${description//\"/\\\"}" result=$(gql "mutation { issueCreate(input: { teamId: \\\"$team_id\\\", title: \\\"$title\\\", description: \\\"$description\\\" }) { success issue { identifier title url } } }") ``` ```bash body="${body//\"/\\\"}" result=$(gql "mutation { commentCreate(input: { issueId: \\\"$issue_uuid\\\", body: \\\"$body\\\" }) { success comment { id } } }") ``` ```bash user_id=$(gql "{ users(filter: { name: { containsIgnoreCase: \\\"$user_name\\\" } }) { nodes { id name } } }" | jq -r '.data.users.nodes[0].id') ...[truncated 2731 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Use GraphQL variables for every dynamic value rather than interpolating values into GraphQL source text. - Build the entire HTTP request with a real JSON encoder, for example: ```bash payload=$(jq -n \ --arg query "$query" \ --argjson variables "$variables" \ '{query: $query, variables: $variables}') curl --silent --show-error --fail-with-body \ -X POST "$API" \ -H "Content-Type: application/json" \ --data-binary "$payload" ``` - Define static GraphQL documents and pass titles, descriptions, comments, project names, usernames, IDs, and other values through the `variables` object. - Validate issue identifiers before use, for example against a strict format such as `^[A-Za-z][A-Za-z0-9_]*-[0-9]+$`. - Restrict team keys and status aliases to documented character sets or explicit allowlists. - Never treat quote replacement alone as sufficient GraphQL or JSON escaping. - Detect and reject GraphQL responses containing an `errors` array before processing `.data`. - Add regression tests containing quotes, backslashes, newlines, tabs, Unicode, malformed issue numbers, and GraphQL punctuation. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/linear.sh:13
Finding: Linear API Key Exposed in Process Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/linear.sh:13-18` **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: Medium ### Vulnerable Code ```bash gql() { local query="$1" curl -s -X POST "$API" \ -H "Content-Type: application/json" \ -H "Authorization: $LINEAR_API_KEY" \ -d "{\"query\": \"$query\"}" } ``` ### Technical Analysis The authorization token is expanded into the argument supplied to `curl` through the `-H` option. While the request is running, the expanded header can be present in the process command-line representation. Depending on operating-system process visibility controls, command-line arguments may be accessible to other processes running under the same account, privileged monitoring agents, diagnostic tools, process collectors, or other local users. Shell debugging or process telemetry may also record the complete argument. The use of HTTPS protects the token in transit but does not prevent this local command-line disclosure. ### Attack Path 1. An attacker obtains the ability to inspect processes on the host, such as through another process under the same user account, a monitoring integration, or sufficient local privileges. 2. The victim invokes any command in `linear.sh`, causing `curl` to run. 3. The attacker repeatedly inspects process command lines or reviews collected process telemetry. 4. The attacker captures the expanded `Authorization: ...` header. 5. The captured token is reused directly against the Linear API. This attack requires local process visibility or access to telemetry that records process arguments. ### Impact Assessment A captured API key allows the attacker to authenticate to Linear with the same API permissions as the victim. The attacker may read or modify workspace information available to that token, including issues, projects, comments, assignments, priorities, and statuses. This issue does not independently provide operati ...[truncated 137 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Avoid placing the authorization header directly in `curl` command-line arguments. - Provide sensitive curl configuration through a protected file descriptor or temporary configuration file with mode `0600`, then delete it immediately after use. - Set `umask 077` before creating any file that may contain credentials. - Ensure shell tracing is disabled around credential handling and never run the script with `set -x`. - Configure process-monitoring and observability systems to redact authorization headers and environment secrets. - Limit the API key to the minimum Linear permissions required and rotate the existing key if process arguments may already have been collected. - Run the Skill under a dedicated account so unrelated processes cannot inspect its environment or process state. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/linear.sh:20
Finding: Predictable Shared Temporary Cache Permits Symlink-Based File Overwrite<![CDATA[ ## Vulnerability Details **File Location**: `scripts/linear.sh:20-29` **Vulnerability Type**: Unsafe predictable temporary file and symlink following **Risk Level**: Medium ### Vulnerable Code ```bash cache_key="$(printf '%s' "$LINEAR_API_KEY" | cksum | awk '{print $1}')" TEAMS_CACHE="${LINEAR_TEAMS_CACHE:-/tmp/linear-teams-${cache_key}.json}" refresh_teams_cache() { gql "{ teams { nodes { id key name } } }" > "$TEAMS_CACHE" } load_teams() { if [[ ! -f "$TEAMS_CACHE" ]]; then refresh_teams_cache fi cat "$TEAMS_CACHE" } ``` The cache is also refreshed directly by the `teams` command: ```bash teams) refresh_teams_cache jq -r '.data.teams.nodes[] | "\(.key)\t\(.name)"' "$TEAMS_CACHE" ;; ``` ### Technical Analysis The default cache is placed in the globally shared `/tmp` directory under a predictable name. The identifier is a non-cryptographic `cksum` value derived from the API key. The file is written using ordinary shell redirection: ```bash > "$TEAMS_CACHE" ``` Shell redirection follows symbolic links and truncates the destination before running the command. The script does not create a private cache directory, atomically reserve the filename, reject symbolic links, verify ownership, or explicitly enforce restrictive file permissions. A local attacker who can identify or observe the cache pathname can replace it with a symbolic link to another file writable by the victim. A subsequent cache refresh then truncates and overwrites the linked target with the Linear API response. The cache may also inherit permissive permissions from the caller's umask, exposing team names and internal team IDs to other local users. The checksum in the filename is not a secure keyed digest. Although it does not directly reveal the complete token, it exposes a stable token-derived value and should not be treated as secret-safe naming. ### Attack Path 1. The victim runs the Skill, or an attacker observes the predictable cache filename in the sha ...[truncated 1140 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Set a restrictive umask near the beginning of the script: ```bash umask 077 ``` - Store cache data in a user-private cache directory, preferably under `${XDG_CACHE_HOME:-$HOME/.cache}`, and create the directory with mode `0700`. - Write updates to a securely created temporary file in the same private directory and atomically rename it: ```bash cache_dir="${XDG_CACHE_HOME:-$HOME/.cache}/linear-cli" mkdir -p -- "$cache_dir" chmod 700 -- "$cache_dir" tmp_file=$(mktemp "$cache_dir/teams.XXXXXX") trap 'rm -f -- "$tmp_file"' EXIT gql '{ teams { nodes { id key name } } }' > "$tmp_file" chmod 600 -- "$tmp_file" mv -f -- "$tmp_file" "$cache_dir/teams.json" trap - EXIT ``` - Verify that the cache directory and existing cache file are owned by the current user and are not symbolic links before use. - Do not derive public filenames from the API key. If distinct token-specific caches are required, use a cryptographic keyed digest stored only inside the private directory. - Validate a caller-supplied `LINEAR_TEAMS_CACHE` path or document that it must reside in a trusted private directory. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises shell command usage throughout the documentation but does not declare corresponding permissions, which can cause users or orchestrators to invoke command-capable behavior without an explicit trust boundary. In an agent setting, undeclared shell capability reduces transparency and weakens policy enforcement around command execution.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: These commands perform live mutations against Linear, including creating issues, commenting, changing status, assigning users, and reprioritizing work, but the documentation does not clearly warn that they alter external project data. In a chat-driven or agent-assisted workflow, a user may trigger irreversible or operationally disruptive changes without realizing the commands are not read-only.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The Git workflow includes commands that modify local repository state, create branches and worktrees, and push to a remote origin, but it lacks an explicit warning that these actions change both local and remote git state. In an agent context, this can lead to unintended branch creation, pushes, or repository drift if a user assumes the workflow is informational rather than mutating.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script exposes multiple state-changing operations (create, comment, status, priority, assign) that immediately perform remote GraphQL mutations against Linear with no dry-run, confirmation prompt, or explicit warning. In an agent-skill context, this increases the chance of unintended changes from mis-parsed inputs, prompt injection, or operator mistakes, because successful execution directly alters external project data.

Static analysis

No suspicious patterns detected.